@vyuhlabs/dxkit 0.8.2 → 0.10.0

package/README.md

@@ -138,15 +138,16 @@ These agents auto-trigger when Claude detects a matching question:
 - **quality-reviewer** — "Review my changes" "Check quality before I commit"
 - **doc-writer** — "What needs documentation?" "Help me write docs"
 
-### Dormant (9) — activate with `/enable-agent`
+### Dormant (10) — activate with `/enable-agent`
 - **codebase-explorer** — Deep architecture analysis, generates documentation
 - **code-reviewer** — PR review and security audit (read-only)
 - **test-writer** — Writes tests for existing code
 - **test-gap-finder** — Identifies critical untested code paths, prioritized by risk
 - **dependency-mapper** — Maps import chains and blast radius of changes
 - **health-auditor** — Comprehensive codebase health audit (scores 6 dimensions)
-- **vulnerability-scanner** — Dependency + code vulnerability analysis
+- **vulnerability-scanner** — CWE-classified security scan (Snyk-comparable depth)
 - **dev-report** — Developer activity, quality patterns, security attribution
+- **dashboard-builder** — Generates HTML dashboard from all reports
 - **debugger** — Systematic root cause analysis
 
 ## Reports
@@ -163,7 +164,9 @@ All analysis commands save timestamped reports to `.ai/reports/`:
   dependency-map-2026-03-30.md         # Import chains, most-depended-on files
 ```
 
-Convert to PDF: `/export-pdf all` or `/export-pdf .ai/reports/health-audit-2026-03-30.md`
+Export options:
+- **HTML dashboard**: `/dashboard` — beautiful dark-themed dashboard with sidebar navigation
+- **PDF**: `/export-pdf all` — converts all reports to PDF
 
 ## Learning System
 
@@ -186,6 +189,24 @@ DXKit generates a GitHub Action that automatically reviews PRs using Claude Code
 
 Reviews appear as PR comments with issues rated as critical/warning/suggestion.
 
+## Vulnerability Scanner (Snyk-Comparable)
+
+The `/vulnerabilities` command runs a comprehensive security scan with CWE classification:
+
+| Category | CWE | What It Checks |
+|---|---|---|
+| Command Injection | CWE-78 | `exec()`, `child_process`, unsanitized input |
+| Decompression Bomb | CWE-409 | zlib/tar/decompress without size limits |
+| Uncontrolled Recursion | CWE-674 | JSON/XML/YAML parsers without depth limits |
+| Arbitrary File Upload | CWE-434 | multer/formidable/busboy without validation |
+| Buffer Overflow | CWE-120 | Native modules (binding.gyp, .node files) |
+| Resource Exhaustion | CWE-770 | Missing rate limits, body size limits, WebSocket payload |
+| Hardcoded Secrets | CWE-798 | Passwords, API keys, tokens in source |
+| Prototype Pollution | CWE-1321 | Via dependency audit CWE extraction |
+| + 15 more CWE categories | | Parsed from `npm audit --json` CWE fields |
+
+Reports include a **Findings by CWE Category** table for direct comparison with Snyk/Sonar output.
+
 ## Smart Detection
 
 - **Test runner** — Detects Jest, Mocha, Vitest, Ava, Tap, pytest, go test from scripts and dependencies

package/dist/constants.d.ts

@@ -1,5 +1,5 @@
 import { ResolvedConfig } from './types';
-export declare const VERSION = "0.8.2";
+export declare const VERSION = "0.10.0";
 export declare const DEFAULT_VERSIONS: {
     python: string;
     go: string;

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,eAAO,MAAM,gBAAgB;;;;;;;;CAQ5B,CAAC;AAEF,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAErC,yEAAyE;AACzE,eAAO,MAAM,cAAc,UAU1B,CAAC;AAEF,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgC7E;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuB/E"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,eAAO,MAAM,OAAO,WAAW,CAAC;AAEhC,eAAO,MAAM,gBAAgB;;;;;;;;CAQ5B,CAAC;AAEF,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAErC,yEAAyE;AACzE,eAAO,MAAM,cAAc,UAU1B,CAAC;AAEF,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgC7E;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuB/E"}

package/dist/constants.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.EVOLVING_FILES = exports.DEFAULT_COVERAGE = exports.DEFAULT_VERSIONS = exports.VERSION = void 0;
 exports.buildVariables = buildVariables;
 exports.buildConditions = buildConditions;
-exports.VERSION = '0.8.2';
+exports.VERSION = '0.10.0';
 exports.DEFAULT_VERSIONS = {
     python: '3.12',
     go: '1.24.0',

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":";;;AA6BA,wCAgCC;AAED,0CAuBC;AApFY,QAAA,OAAO,GAAG,OAAO,CAAC;AAElB,QAAA,gBAAgB,GAAG;IAC9B,MAAM,EAAE,MAAM;IACd,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,KAAK;IACb,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,GAAG;CACX,CAAC;AAEW,QAAA,gBAAgB,GAAG,IAAI,CAAC;AAErC,yEAAyE;AAC5D,QAAA,cAAc,GAAG;IAC5B,8CAA8C;IAC9C,kDAAkD;IAClD,2DAA2D;IAC3D,8CAA8C;IAC9C,2CAA2C;IAC3C,6CAA6C;IAC7C,6CAA6C;IAC7C,kCAAkC;IAClC,oDAAoD;CACrD,CAAC;AAEF,SAAgB,cAAc,CAAC,MAAsB;IACnD,MAAM,CAAC,GAA2B;QAChC,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,kBAAkB,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;QACzD,kBAAkB,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;QACzD,mBAAmB,EAAE,MAAM,CAAC,kBAAkB,IAAI,WAAW;QAC7D,UAAU,EAAE,OAAO;QACnB,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,wBAAgB,CAAC,MAAM;QACjE,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,wBAAgB,CAAC,EAAE;QACrD,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,wBAAgB,CAAC,IAAI;QAC3D,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,wBAAgB,CAAC,IAAI;QAC3D,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,wBAAgB,CAAC,MAAM;QACjE,gBAAgB,EAAE,wBAAgB,CAAC,QAAQ;QAC3C,aAAa,EAAE,wBAAgB,CAAC,KAAK;QACrC,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,UAAU;QACnB,WAAW,EAAE,cAAc;QAC3B,kBAAkB,EAAE,MAAM,CAAC,iBAAiB,IAAI,wBAAgB;QAChE,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,IAAI,UAAU;QACtD,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,IAAI,SAAS;QACzD,qBAAqB,EAAE,MAAM,CAAC,UAAU,EAAE,eAAe,IAAI,EAAE;QAC/D,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;KAClC,CAAC;IAEF,oBAAoB;IACpB,CAAC,CAAC,oBAAoB,GAAG,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC,gBAAgB,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACxF,CAAC,CAAC,SAAS,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAC/F,CAAC,CAAC,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC,cAAc,CAAC;IAExC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAgB,eAAe,CAAC,MAAsB;IACpD,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;QAClC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE;QAC1B,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM;QACzD,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI;QAC9B,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;QAClC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;QAClC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ;QAC3C,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,KAAK;QACrC,eAAe,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK;QAC9E,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,MAAM;QACvC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;QAC9B,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;QAC9B,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;QACpC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;QAC7B,cAAc,EAAE,MAAM,CAAC,UAAU;QACjC,iBAAiB,EAAE,MAAM,CAAC,aAAa;QACvC,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,iBAAiB,IAAI,wBAAgB,CAAC,GAAG,CAAC;QAC/E,YAAY,EAAE,MAAM,CAAC,SAAS;QAC9B,cAAc,EAAE,MAAM,CAAC,UAAU;QACjC,aAAa,EAAE,MAAM,CAAC,SAAS;KAChC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":";;;AA6BA,wCAgCC;AAED,0CAuBC;AApFY,QAAA,OAAO,GAAG,QAAQ,CAAC;AAEnB,QAAA,gBAAgB,GAAG;IAC9B,MAAM,EAAE,MAAM;IACd,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,KAAK;IACb,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,GAAG;CACX,CAAC;AAEW,QAAA,gBAAgB,GAAG,IAAI,CAAC;AAErC,yEAAyE;AAC5D,QAAA,cAAc,GAAG;IAC5B,8CAA8C;IAC9C,kDAAkD;IAClD,2DAA2D;IAC3D,8CAA8C;IAC9C,2CAA2C;IAC3C,6CAA6C;IAC7C,6CAA6C;IAC7C,kCAAkC;IAClC,oDAAoD;CACrD,CAAC;AAEF,SAAgB,cAAc,CAAC,MAAsB;IACnD,MAAM,CAAC,GAA2B;QAChC,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,kBAAkB,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;QACzD,kBAAkB,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;QACzD,mBAAmB,EAAE,MAAM,CAAC,kBAAkB,IAAI,WAAW;QAC7D,UAAU,EAAE,OAAO;QACnB,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,wBAAgB,CAAC,MAAM;QACjE,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,wBAAgB,CAAC,EAAE;QACrD,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,wBAAgB,CAAC,IAAI;QAC3D,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,wBAAgB,CAAC,IAAI;QAC3D,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,wBAAgB,CAAC,MAAM;QACjE,gBAAgB,EAAE,wBAAgB,CAAC,QAAQ;QAC3C,aAAa,EAAE,wBAAgB,CAAC,KAAK;QACrC,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,UAAU;QACnB,WAAW,EAAE,cAAc;QAC3B,kBAAkB,EAAE,MAAM,CAAC,iBAAiB,IAAI,wBAAgB;QAChE,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,IAAI,UAAU;QACtD,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,IAAI,SAAS;QACzD,qBAAqB,EAAE,MAAM,CAAC,UAAU,EAAE,eAAe,IAAI,EAAE;QAC/D,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;KAClC,CAAC;IAEF,oBAAoB;IACpB,CAAC,CAAC,oBAAoB,GAAG,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC,gBAAgB,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACxF,CAAC,CAAC,SAAS,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAC/F,CAAC,CAAC,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC,cAAc,CAAC;IAExC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAgB,eAAe,CAAC,MAAsB;IACpD,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;QAClC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE;QAC1B,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM;QACzD,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI;QAC9B,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;QAClC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;QAClC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ;QAC3C,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,KAAK;QACrC,eAAe,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK;QAC9E,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,MAAM;QACvC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;QAC9B,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;QAC9B,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;QACpC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;QAC7B,cAAc,EAAE,MAAM,CAAC,UAAU;QACjC,iBAAiB,EAAE,MAAM,CAAC,aAAa;QACvC,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,iBAAiB,IAAI,wBAAgB,CAAC,GAAG,CAAC;QAC/E,YAAY,EAAE,MAAM,CAAC,SAAS;QAC9B,cAAc,EAAE,MAAM,CAAC,UAAU;QACjC,aAAa,EAAE,MAAM,CAAC,SAAS;KAChC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vyuhlabs/dxkit",
-  "version": "0.8.2",
+  "version": "0.10.0",
   "description": "AI-native developer experience toolkit for any repository",
   "license": "MIT",
   "bin": {

package/templates/.claude/agents-available/dashboard-builder.md

@@ -0,0 +1,433 @@
+---
+name: dashboard-builder
+description: Generates a beautiful HTML dashboard from all reports in .ai/reports/. Use when asked to "build dashboard", "export reports", or "create report dashboard". Reads reports and generates a self-contained HTML file.
+model: sonnet
+tools: Read, Grep, Glob, Bash, Write
+---
+
+You are a dashboard builder. Your job is to create a beautiful, self-contained HTML dashboard that renders all markdown reports from `.ai/reports/`.
+
+## Steps
+
+1. **Find all reports**: Glob for `.ai/reports/*.md`
+2. **Read each report**: Get the markdown content
+3. **Detect project name**: From `CLAUDE.md`, `package.json`, or directory name
+4. **Generate dashboard**: Create `.ai/reports/dashboard.html`
+
+## Dashboard Design
+
+The dashboard should be a **single self-contained HTML file** with:
+- No external dependencies except CDN links for marked.js (markdown rendering)
+- Dark theme with modern design (GitHub-dark inspired)
+- Fully responsive
+
+### Layout
+- **Header**: Project name, VyuhLabs DXKit branding, generation date
+- **Sidebar**: Report navigation grouped by type with icons
+- **Main area**: Rendered markdown report with proper styling
+- **Footer**: VyuhLabs DXKit branding
+
+### Report Type Icons & Colors
+Use these emoji/labels for report types:
+- `health-audit` → "Health Audit" with green accent
+- `vulnerability-scan` → "Vulnerability Scan" with red accent
+- `developer-report` → "Developer Report" with blue accent
+- `test-gaps` → "Test Gaps" with orange accent
+- `docs-audit` → "Documentation" with purple accent
+- `dependency-map` → "Dependencies" with cyan accent
+
+### Design Requirements
+- Smooth transitions when switching reports
+- Table styling that's readable on dark backgrounds
+- Code blocks with syntax highlighting colors
+- Proper heading hierarchy
+- Score badges for health reports (color-coded: red/yellow/green)
+- Sticky sidebar on desktop, collapsible on mobile
+- Print-friendly styles (@media print)
+
+## HTML Template
+
+Generate this exact structure (fill in REPORTS_DATA and PROJECT_NAME):
+
+```html
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>PROJECT_NAME — DXKit Reports</title>
+  <script src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
+  <style>
+    :root {
+      --bg-primary: #0d1117;
+      --bg-secondary: #161b22;
+      --bg-tertiary: #21262d;
+      --border: #30363d;
+      --text-primary: #f0f6fc;
+      --text-secondary: #c9d1d9;
+      --text-muted: #8b949e;
+      --accent-blue: #58a6ff;
+      --accent-green: #3fb950;
+      --accent-red: #f85149;
+      --accent-orange: #d29922;
+      --accent-purple: #bc8cff;
+      --accent-cyan: #39d2c0;
+      --sidebar-width: 300px;
+    }
+
+    * { margin: 0; padding: 0; box-sizing: border-box; }
+
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', sans-serif;
+      background: var(--bg-primary);
+      color: var(--text-secondary);
+      display: flex;
+      height: 100vh;
+      overflow: hidden;
+    }
+
+    /* Sidebar */
+    .sidebar {
+      width: var(--sidebar-width);
+      background: var(--bg-secondary);
+      border-right: 1px solid var(--border);
+      display: flex;
+      flex-direction: column;
+      flex-shrink: 0;
+      overflow: hidden;
+    }
+
+    .sidebar-header {
+      padding: 20px;
+      border-bottom: 1px solid var(--border);
+    }
+
+    .sidebar-header h1 {
+      font-size: 18px;
+      color: var(--text-primary);
+      font-weight: 600;
+    }
+
+    .sidebar-header .project-name {
+      font-size: 13px;
+      color: var(--accent-blue);
+      margin-top: 4px;
+    }
+
+    .sidebar-header .generated {
+      font-size: 11px;
+      color: var(--text-muted);
+      margin-top: 2px;
+    }
+
+    .sidebar-nav {
+      flex: 1;
+      overflow-y: auto;
+      padding: 12px;
+    }
+
+    .report-group {
+      margin-bottom: 16px;
+    }
+
+    .report-group-title {
+      font-size: 11px;
+      text-transform: uppercase;
+      letter-spacing: 0.8px;
+      color: var(--text-muted);
+      padding: 4px 8px;
+      margin-bottom: 4px;
+      display: flex;
+      align-items: center;
+      gap: 6px;
+    }
+
+    .report-group-title .dot {
+      width: 8px;
+      height: 8px;
+      border-radius: 50%;
+      flex-shrink: 0;
+    }
+
+    .report-btn {
+      display: block;
+      width: 100%;
+      text-align: left;
+      background: none;
+      border: none;
+      color: var(--text-secondary);
+      padding: 8px 12px;
+      border-radius: 8px;
+      cursor: pointer;
+      font-size: 13px;
+      margin-bottom: 2px;
+      transition: all 0.15s ease;
+      font-family: inherit;
+    }
+
+    .report-btn:hover {
+      background: var(--bg-tertiary);
+    }
+
+    .report-btn.active {
+      background: var(--accent-blue);
+      color: white;
+      font-weight: 500;
+    }
+
+    .report-btn .date {
+      font-size: 11px;
+      color: var(--text-muted);
+      display: block;
+      margin-top: 2px;
+    }
+
+    .report-btn.active .date {
+      color: rgba(255,255,255,0.7);
+    }
+
+    .sidebar-footer {
+      padding: 16px 20px;
+      border-top: 1px solid var(--border);
+      font-size: 11px;
+      color: var(--text-muted);
+    }
+
+    .sidebar-footer a {
+      color: var(--accent-blue);
+      text-decoration: none;
+    }
+
+    /* Main content */
+    .main {
+      flex: 1;
+      overflow-y: auto;
+      padding: 40px;
+    }
+
+    .main-inner {
+      max-width: 860px;
+      margin: 0 auto;
+    }
+
+    .empty-state {
+      text-align: center;
+      color: var(--text-muted);
+      margin-top: 30vh;
+    }
+
+    .empty-state h2 {
+      font-size: 20px;
+      margin-bottom: 8px;
+      color: var(--text-secondary);
+    }
+
+    /* Markdown rendering */
+    .main-inner h1 { font-size: 28px; color: var(--text-primary); border-bottom: 1px solid var(--border); padding-bottom: 12px; margin-bottom: 20px; }
+    .main-inner h2 { font-size: 22px; color: var(--text-primary); margin-top: 32px; margin-bottom: 12px; padding-bottom: 8px; border-bottom: 1px solid var(--border); }
+    .main-inner h3 { font-size: 17px; color: var(--text-primary); margin-top: 24px; margin-bottom: 8px; }
+    .main-inner h4 { font-size: 15px; color: var(--text-primary); margin-top: 16px; margin-bottom: 6px; }
+    .main-inner p { line-height: 1.7; margin-bottom: 14px; }
+    .main-inner a { color: var(--accent-blue); text-decoration: none; }
+    .main-inner a:hover { text-decoration: underline; }
+    .main-inner strong { color: var(--text-primary); }
+    .main-inner em { color: var(--text-muted); }
+
+    .main-inner ul, .main-inner ol { padding-left: 24px; margin-bottom: 14px; }
+    .main-inner li { margin-bottom: 6px; line-height: 1.6; }
+    .main-inner li::marker { color: var(--text-muted); }
+
+    .main-inner table { border-collapse: collapse; width: 100%; margin-bottom: 20px; font-size: 14px; }
+    .main-inner th { background: var(--bg-secondary); color: var(--text-primary); font-weight: 600; text-align: left; padding: 10px 14px; border: 1px solid var(--border); }
+    .main-inner td { padding: 10px 14px; border: 1px solid var(--border); }
+    .main-inner tr:hover td { background: rgba(56, 139, 253, 0.04); }
+
+    .main-inner code {
+      background: var(--bg-secondary);
+      padding: 2px 7px;
+      border-radius: 5px;
+      font-size: 13px;
+      font-family: 'SF Mono', 'Fira Code', 'Cascadia Code', monospace;
+      color: var(--accent-blue);
+    }
+
+    .main-inner pre {
+      background: var(--bg-secondary);
+      padding: 18px;
+      border-radius: 10px;
+      overflow-x: auto;
+      margin-bottom: 18px;
+      border: 1px solid var(--border);
+    }
+
+    .main-inner pre code {
+      background: none;
+      padding: 0;
+      color: var(--text-secondary);
+      font-size: 13px;
+      line-height: 1.5;
+    }
+
+    .main-inner blockquote {
+      border-left: 3px solid var(--accent-blue);
+      padding: 8px 16px;
+      color: var(--text-muted);
+      margin-bottom: 14px;
+      background: rgba(56, 139, 253, 0.04);
+      border-radius: 0 6px 6px 0;
+    }
+
+    .main-inner hr {
+      border: none;
+      border-top: 1px solid var(--border);
+      margin: 28px 0;
+    }
+
+    .main-inner img { max-width: 100%; border-radius: 8px; }
+
+    /* Mobile */
+    .mobile-toggle {
+      display: none;
+      position: fixed;
+      top: 12px;
+      left: 12px;
+      z-index: 100;
+      background: var(--bg-secondary);
+      border: 1px solid var(--border);
+      color: var(--text-primary);
+      padding: 8px 12px;
+      border-radius: 8px;
+      cursor: pointer;
+      font-size: 14px;
+    }
+
+    @media (max-width: 768px) {
+      .sidebar { position: fixed; left: -300px; z-index: 50; height: 100vh; transition: left 0.3s ease; }
+      .sidebar.open { left: 0; box-shadow: 4px 0 20px rgba(0,0,0,0.5); }
+      .mobile-toggle { display: block; }
+      .main { padding: 20px; padding-top: 56px; }
+    }
+
+    /* Print */
+    @media print {
+      body { background: white; color: #1a1a1a; }
+      .sidebar, .mobile-toggle { display: none; }
+      .main { padding: 20px; }
+      .main-inner h1, .main-inner h2, .main-inner h3 { color: #1a1a1a; }
+      .main-inner code { background: #f0f0f0; color: #1a1a1a; }
+      .main-inner pre { background: #f6f6f6; border-color: #ddd; }
+      .main-inner th { background: #f0f0f0; }
+      .main-inner td, .main-inner th { border-color: #ddd; }
+    }
+
+    /* Scrollbar */
+    ::-webkit-scrollbar { width: 8px; }
+    ::-webkit-scrollbar-track { background: transparent; }
+    ::-webkit-scrollbar-thumb { background: var(--bg-tertiary); border-radius: 4px; }
+    ::-webkit-scrollbar-thumb:hover { background: var(--border); }
+
+    /* Animations */
+    .main-inner { animation: fadeIn 0.2s ease; }
+    @keyframes fadeIn { from { opacity: 0; transform: translateY(8px); } to { opacity: 1; transform: translateY(0); } }
+  </style>
+</head>
+<body>
+  <button class="mobile-toggle" onclick="document.querySelector('.sidebar').classList.toggle('open')">Menu</button>
+
+  <div class="sidebar">
+    <div class="sidebar-header">
+      <h1>DXKit Reports</h1>
+      <div class="project-name">PROJECT_NAME</div>
+      <div class="generated">Generated GENERATION_DATE</div>
+    </div>
+    <div class="sidebar-nav" id="nav"></div>
+    <div class="sidebar-footer">
+      Powered by <a href="https://www.npmjs.com/package/@vyuhlabs/dxkit" target="_blank">VyuhLabs DXKit</a>
+    </div>
+  </div>
+
+  <div class="main">
+    <div class="main-inner" id="content">
+      <div class="empty-state">
+        <h2>Select a report</h2>
+        <p>Choose a report from the sidebar to view it</p>
+      </div>
+    </div>
+  </div>
+
+  <script>
+    const reports = REPORTS_JSON;
+
+    const typeConfig = {
+      'health-audit':       { label: 'Health Audit',       color: '#3fb950' },
+      'vulnerability-scan': { label: 'Vulnerability Scan', color: '#f85149' },
+      'developer-report':   { label: 'Developer Report',   color: '#58a6ff' },
+      'test-gaps':          { label: 'Test Gaps',          color: '#d29922' },
+      'docs-audit':         { label: 'Documentation',      color: '#bc8cff' },
+      'dependency-map':     { label: 'Dependencies',       color: '#39d2c0' },
+    };
+
+    const nav = document.getElementById('nav');
+    const content = document.getElementById('content');
+
+    // Group reports by type
+    const groups = {};
+    Object.keys(reports).forEach(name => {
+      const type = name.replace(/-\d{4}-\d{2}-\d{2}$/, '');
+      if (!groups[type]) groups[type] = [];
+      groups[type].push(name);
+    });
+
+    // Build navigation
+    Object.entries(groups).forEach(([type, names]) => {
+      const cfg = typeConfig[type] || { label: type.replace(/-/g, ' '), color: '#8b949e' };
+      const group = document.createElement('div');
+      group.className = 'report-group';
+      group.innerHTML = '<div class="report-group-title"><span class="dot" style="background:' + cfg.color + '"></span>' + cfg.label + '</div>';
+
+      names.sort().reverse().forEach(name => {
+        const dateMatch = name.match(/(\d{4}-\d{2}-\d{2})$/);
+        const date = dateMatch ? dateMatch[1] : '';
+        const btn = document.createElement('button');
+        btn.className = 'report-btn';
+        btn.innerHTML = cfg.label + (date ? '<span class="date">' + date + '</span>' : '');
+        btn.onclick = () => {
+          document.querySelectorAll('.report-btn').forEach(b => b.classList.remove('active'));
+          btn.classList.add('active');
+          content.innerHTML = '<div class="main-inner" style="animation:fadeIn 0.2s ease">' + marked.parse(reports[name]) + '</div>';
+          // Close mobile sidebar
+          document.querySelector('.sidebar').classList.remove('open');
+        };
+        group.appendChild(btn);
+      });
+      nav.appendChild(group);
+    });
+
+    // Auto-select first report
+    const firstBtn = nav.querySelector('.report-btn');
+    if (firstBtn) firstBtn.click();
+  </script>
+</body>
+</html>
+```
+
+## Building the REPORTS_JSON
+
+For each `.md` file in `.ai/reports/`:
+1. Read the file content
+2. Escape for JavaScript: replace `\` with `\\`, backticks with `\`+backtick, `${` with `\${`, and `</script>` with `<\/script>`
+3. Build a JSON object: `{ "filename-without-ext": "escaped markdown content" }`
+
+Replace `PROJECT_NAME` with the project name.
+Replace `GENERATION_DATE` with today's date.
+Replace `REPORTS_JSON` with the JSON object.
+
+## After Generation
+
+Tell the user:
+- Dashboard saved to `.ai/reports/dashboard.html`
+- Open it in a browser: `open .ai/reports/dashboard.html` (macOS) or `xdg-open .ai/reports/dashboard.html` (Linux)
+- Print to PDF from the browser for a shareable document
+
+---
+*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit) dashboard-builder agent*

package/templates/.claude/agents-available/vulnerability-scanner.md

@@ -1,74 +1,112 @@
 ---
 name: vulnerability-scanner
-description: Scans dependencies and code for security vulnerabilities. Use when asked about vulnerabilities, "is this secure?", "audit dependencies", or "security scan". Saves report to .ai/reports/.
+description: Comprehensive security vulnerability scanner — dependencies (with CWE classification), code patterns, file uploads, decompression bombs, recursion depth, native modules, resource limits. Use when asked about vulnerabilities, "is this secure?", "audit dependencies", or "security scan". Saves report to .ai/reports/.
 model: sonnet
 tools: Read, Grep, Glob, Bash, Write
 ---
 
-You are a security vulnerability analyst. Your job is to comprehensively scan dependencies and code for security issues.
-
-## Strategy
-
-### Phase 1: Dependency Vulnerabilities
-
-Run built-in audit tools for each detected language:
-
-**Node.js:**
-- Run `npm audit --json 2>/dev/null` — parse severity counts
-- Run `npm outdated --json 2>/dev/null` — find outdated packages
-- Check for known vulnerable packages (event-stream, ua-parser-js, colors, etc.)
-
-**Python:**
+You are a security vulnerability analyst. Your job is to comprehensively scan dependencies and code for security issues, classify findings by CWE, and produce an actionable report.
+
+## Phase 1: Dependency Vulnerabilities with CWE Classification
+
+### Node.js
+Run `npm audit --json 2>/dev/null` and parse the full output:
+1. Extract severity counts (critical/high/medium/low)
+2. **Extract CWE fields** from each advisory's `via` entries (skip string entries — those are transitive refs)
+3. Group findings by CWE category using this mapping:
+
+| CWE | Name |
+|-----|------|
+| CWE-22 | Directory Traversal |
+| CWE-78 | Command Injection |
+| CWE-94 | Arbitrary Code Injection |
+| CWE-120 | Buffer Overflow |
+| CWE-248 | Uncaught Exception |
+| CWE-352 | Cross-Site Request Forgery |
+| CWE-400 | Uncontrolled Resource Consumption |
+| CWE-407 | Inefficient Algorithmic Complexity |
+| CWE-409 | Decompression Bomb |
+| CWE-434 | Arbitrary File Upload |
+| CWE-674 | Uncontrolled Recursion |
+| CWE-770 | Allocation Without Limits |
+| CWE-772 | Missing Resource Release |
+| CWE-835 | Infinite Loop |
+| CWE-918 | Server-Side Request Forgery |
+| CWE-1321 | Prototype Pollution |
+| CWE-1333 | ReDoS |
+
+Also run `npm outdated --json 2>/dev/null` for outdated packages.
+
+### Python
 - Run `pip audit 2>/dev/null` or `safety check 2>/dev/null` if available
-- Read `requirements.txt` or `pyproject.toml` — check for pinned vs unpinned versions
-- Check for known vulnerable packages (pyyaml, requests, pillow older versions)
-
-**Go:**
-- Run `govulncheck ./... 2>/dev/null` if available
-- Read `go.sum` for dependency count
+- Check for pinned vs unpinned versions in `requirements.txt` / `pyproject.toml`
 
-**Rust:**
-- Run `cargo audit 2>/dev/null` if available
+### Go / Rust / C#
+- Run `govulncheck ./... 2>/dev/null`, `cargo audit 2>/dev/null`, `dotnet list package --vulnerable 2>/dev/null`
 
-**C#:**
-- Run `dotnet list package --vulnerable 2>/dev/null` if available
+## Phase 2: Code-Level Vulnerability Scan
 
-### Phase 2: Code-Level Vulnerabilities
+### Injection (CWE-78, CWE-89, CWE-79)
+- **Command injection**: `exec(`, `child_process`, `os.system(`, `subprocess.call(` — flag if input could be user-controlled
+- **SQL injection**: string concatenation in queries, template literals with user input
+- **XSS**: `dangerouslySetInnerHTML`, `v-html`, unescaped output in templates
 
-Search the codebase for common vulnerability patterns:
-
-**Injection:**
-- SQL: string concatenation in queries (`"SELECT.*" +`, template literals with user input)
-- Command injection: `exec(`, `child_process`, `os.system(`, `subprocess.call(` with unsanitized input
-- XSS: `dangerouslySetInnerHTML`, `v-html`, unescaped output
-
-**Authentication & Authorization:**
+### Authentication & Secrets (CWE-798, CWE-327)
 - Hardcoded secrets: `password\s*=\s*['"]`, `apiKey`, `secret\s*=`, `token\s*=\s*['"]`
 - Weak crypto: `md5`, `sha1` for passwords, `Math.random` for tokens
 - JWT issues: `algorithm.*none`, missing expiry, hardcoded signing keys
 
-**Data Exposure:**
+### Decompression Bomb (CWE-409)
+- `zlib.createGunzip()`, `createInflate()`, `createUnzip()` — flag if no `maxOutputLength`
+- `tar.extract()`, `tar.x()` — flag if no `maxReadSize` or size filter
+- `require('decompress')`, `require('unzipper')`, `require('adm-zip')` — flag on user-uploaded files
+- `express.json()`, `bodyParser.json()` — flag if no `limit` option
+
+### Uncontrolled Recursion (CWE-674)
+- `JSON.parse(` on user input without depth validation
+- XML parsers (`fast-xml-parser`, `xml2js`, `@xmldom/xmldom`) — flag if no `maxDepth`
+- `yaml.load()` instead of `yaml.safeLoad()`, no schema restriction
+- Custom recursive functions processing user data without depth guards
+
+### Arbitrary File Upload (CWE-434)
+- `multer` — flag if no `fileFilter`, no `limits.fileSize`, storage in web-accessible dir
+- `formidable` — flag if no `maxFileSize`, no type validation
+- `busboy` — flag if no `limits` option
+- `fs.writeFile`/`createWriteStream` with user-controlled path — flag if no extension/MIME validation
+
+### Resource Allocation Without Limits (CWE-770)
+- No rate limiting middleware (`express-rate-limit`, `RateLimiter`)
+- `express.json()`/`bodyParser` without `limit` option
+- WebSocket without `maxPayload`: `socket.on('message'`, `ws.on('message'`
+- Database queries without `.limit()` or pagination on user-facing endpoints
+
+### Data Exposure
 - Sensitive data in logs: `console.log.*password`, `print.*secret`
-- Debug mode in production: `DEBUG=true`, `debug: true`
-- Exposed stack traces: error handlers returning full stack
+- Debug mode: `DEBUG=true`, `debug: true` in production config
+- Exposed stack traces in error handlers
+- CORS wildcard: `Access-Control-Allow-Origin: *`
+
+## Phase 3: Native Module Audit (CWE-120)
 
-**File System:**
-- Path traversal: unvalidated file paths, `../` in user input
-- Unsafe file uploads: no extension/MIME validation
+Run these checks:
+```bash
+find node_modules -name "*.node" -type f 2>/dev/null | head -20
+find node_modules -name "binding.gyp" -maxdepth 3 2>/dev/null | head -20
+```
+
+Known native packages with historical buffer overflow CVEs:
+- `sharp` (libvips), `bcrypt` (OpenSSL), `node-canvas` (cairo), `sqlite3`, `grpc`, `bufferutil`
 
-**Configuration:**
-- CORS: `Access-Control-Allow-Origin: *`
-- Missing security headers (CSP, HSTS, X-Frame-Options)
-- HTTP instead of HTTPS in URLs
+Flag native modules not covered by npm audit for manual review.
 
-### Phase 3: Dependency Chain Risk
+## Phase 4: Dependency Chain Risk
 
 - Count total dependencies (direct + transitive)
-- Identify large dependency trees (supply chain risk)
-- Check for abandoned packages (no updates in 2+ years)
-- Flag packages with very few weekly downloads
+- Identify largest dependency trees (supply chain risk)
+- Check for abandoned packages (>2yr no update)
+- Count native modules in tree
 
-### Phase 4: Generate Report
+## Phase 5: Generate Report
 
 Save to `.ai/reports/vulnerability-scan-YYYY-MM-DD.md`:
 
@@ -76,25 +114,43 @@ Save to `.ai/reports/vulnerability-scan-YYYY-MM-DD.md`:
 ## Vulnerability Scan Report
 
 ### Summary
-| Severity | Count |
-|----------|-------|
-| Critical | X |
-| High | X |
-| Medium | X |
-| Low | X |
+| Severity | Dependency Issues | Code Issues | Total |
+|----------|------------------|-------------|-------|
+| Critical | X | X | X |
+| High | X | X | X |
+| Medium | X | X | X |
+| Low | X | X | X |
+
+### Findings by CWE Category
+| CWE | Category | Dep. Issues | Code Issues | Severity |
+|-----|----------|-------------|-------------|----------|
+| CWE-78 | Command Injection | 0 | 2 | Critical |
+| CWE-770 | Allocation Without Limits | 4 | 1 | High |
+| CWE-835 | Infinite Loop | 2 | 0 | High |
+| CWE-409 | Decompression Bomb | 0 | 1 | High |
+| CWE-674 | Uncontrolled Recursion | 1 | 0 | Medium |
+| CWE-434 | Arbitrary File Upload | 0 | 1 | Medium |
 
 ### Dependency Vulnerabilities
-| Package | Severity | Description | Fix |
-|---------|----------|-------------|-----|
-| lodash@4.17.15 | High | Prototype pollution | Upgrade to 4.17.21 |
+| Package | Severity | CWE | Description | Fix |
+|---------|----------|-----|-------------|-----|
+| tar@6.1.11 | High | CWE-409 | Decompression bomb | Upgrade to 6.2.0 |
 
 ### Code Vulnerabilities
-| File:Line | Severity | Type | Description |
-|-----------|----------|------|-------------|
-| src/auth.ts:42 | Critical | Hardcoded secret | JWT key in source |
+| File:Line | Severity | CWE | Type | Description |
+|-----------|----------|-----|------|-------------|
+| src/auth.ts:42 | Critical | CWE-798 | Hardcoded secret | JWT key in source |
+| src/upload.ts:10 | High | CWE-434 | File upload | multer without fileFilter |
+
+### Native Modules
+| Package | Type | Has Advisories | Notes |
+|---------|------|----------------|-------|
+| sharp@0.32.1 | binding.gyp | Yes (2 high) | Image processing |
+| bcrypt@5.1.0 | binding.gyp | No | Manual review recommended |
 
 ### Dependency Health
 - Total dependencies: X (direct: Y, transitive: Z)
+- Native modules: X
 - Outdated: X packages
 - Abandoned (>2yr no update): X packages
 
@@ -108,10 +164,10 @@ Save to `.ai/reports/vulnerability-scan-YYYY-MM-DD.md`:
 
 ## Rules
 
-- **Run real tools** — don't guess, run `npm audit`, `pip audit`, etc.
-- **Be specific** — exact package versions, file:line references, CVE numbers when available
+- **Run real tools** — don't guess, run `npm audit --json`, `pip audit`, etc.
+- **Classify by CWE** — every finding should have a CWE number
+- **Be specific** — exact package versions, file:line references, CVE/GHSA numbers
 - **Prioritize by exploitability** — a reachable RCE is worse than a theoretical DoS
 - **Include fix instructions** — "upgrade X to Y" or "replace pattern A with B"
 - **Never output actual secret values** — say "hardcoded secret found at file:line", don't print it
 - Save the report to `.ai/reports/vulnerability-scan-YYYY-MM-DD.md`
-- **Always end the report with:** `---` followed by `*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit) vulnerability-scanner agent*`

package/templates/.claude/commands/dashboard.md

@@ -0,0 +1,20 @@
+---
+description: Generate a beautiful HTML dashboard from all reports
+---
+
+Delegate to the **dashboard-builder** agent. It will read all reports from `.ai/reports/` and generate a self-contained HTML dashboard at `.ai/reports/dashboard.html`.
+
+The dashboard features:
+- Dark theme with modern design
+- Sidebar navigation grouped by report type with color-coded indicators
+- Full markdown rendering with styled tables, code blocks, and headings
+- Responsive layout (works on mobile)
+- Print-friendly styles
+
+**IMPORTANT: End the report with this exact footer:**
+```
+---
+*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*
+```
+
+$ARGUMENTS

package/templates/CLAUDE.md.template

@@ -162,6 +162,7 @@ Slash commands for common workflows. Run `/help` to list all with descriptions.
 - `/vulnerabilities` - Scan dependencies and code for security issues
 - `/dev-report` - Developer activity and code quality report
 - `/docs` - Audit, write, or improve documentation
+- `/dashboard` - Generate HTML dashboard from all reports
 - `/export-pdf` - Convert markdown reports to PDF
 - `/fix-issue <number>` - Investigate and fix a GitHub issue
 
@@ -184,6 +185,7 @@ Language-specific conventions that activate automatically when editing matching
 - `health-auditor` — Comprehensive codebase health audit (sonnet, read-only)
 - `vulnerability-scanner` — Dependency and code vulnerability analysis (sonnet)
 - `dev-report` — Developer activity, quality patterns, security attribution (sonnet)
+- `dashboard-builder` — Generates HTML dashboard from all reports (sonnet)
 - `doc-writer` — Audits docs, identifies gaps, writes/improves documentation (sonnet)
 - `debugger` — Traces root causes systematically (sonnet, no file edits)